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DETAILED ACTION 

Response to Amendment 

Applicant's arguments/amendments with respect to amended claims 1 & 12, previously 

presented claims 2-1 1 & 13-26 filed 6/26/2007 have been fully considered and therefore the 
claims are rejected under new grounds. The Examiner would like to point out that this action is 
made final (See MPEP 706.07a). 



Claim Rejections - 35 USC § 112 
The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

Claims 1-26 are rejected under 35 U.S.C. 112, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention. 
As per claims 1 and 12: 

Regarding claims 1 and 12, the phrase "some or all" renders the claim indefinite because 
it is unclear what the term "some" encompasses and one of ordinary skill in the art would not be 
reasonably apprised of the scope of the invention. 
As per claims 2-1 1 and 13-26: 

These claims are rejected by virtue of their dependency. 
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Claim Rejections - 35 USC § 103 
L The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

11. Claims 1-7, 9, 1 1-18, 20, and 22-26 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Bates et al.. United States Patent No. 6,785,732 and further in view of Hill et 
al.. United States Patent No. 6,088,804. 
As per claims 1 and 12: 

Bates et al. substantially teach a system/method comprising: a plurality of client users 
having potentially infected client end-user computers, said end-user computers being distributed 
over said distributed computer network (col. 3, lines 41-50); a first anti-virus scanning server 
executing from a first vendor and a second antivirus scanning server executing software from a 
second vendor, each accessible via the distributed computer network, said first anti-virus 
scanning server and said second anti-virus scanning server each including an anti-virus scanning 
program, whereby the client users contact the first scanning server or the second scanning server 
to facilitate virus scanning of the client end-user computers by downloading said anti-virus 
scanning program (col. 8, line 45 - col. 9, line 1 1 and Fig. 6); a scan log which is sent back to at 
least one of the first anti-virus scanning server and the second anti-virus scanning server over 
said distributed computer network fi:om each client user detailing all results of the virus scanning 
on each client end-user computer by said antivirus scanning program (col. 8, lines 1 1-15); a 
virus-tracking server for receiving the scan log information from said client end-user computers 
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via the first anti-virus scanning server from the first vendor and the second anti-virus scanning 
server from the second vendor (col. 6, lines 4-20 and col. 9, lines 47-60); a database server 
associated with the virus-checking server for processing the scan log information into virus- 
tracking information (col. 6, lines 4-20 and col. 9, lines 47-60); and a tracking user from the 
virus tracking server (col. 11, lines 39-67). 

Not explicitly disclosed is wherein the scan log information is received by the virus- 
tracking server in real time and at least one virus-tracking display mode accessible by a tracking 
user, the display mode providing real-time updates of said virus-tracking information pertaining 
to the scan logs, wherein the anti-virus scanning program residing at the client end-user 
computers generates one or more maps displaying the real-time updates, and wherein the one or 
more maps are generated and displayed at the client end-user computers. However, Hill et al. 
teach displaying in real-time, to an administrator of some type, graphs of virus detection 
incidents in various geographical sub-regions in order to keep track of potential viruses that may 
spread and damage other systems if no action is taken (col. 3, lines 36-41). Hill et al. further 
teach that each of the agents who provide the information recorded and displayed in the graph 
may also view the graph so that they are aware of how quickly and in what sub-regions a 
virus/attack is spreading (col. 8, line 59 - col. 9, line 25). Therefore, it would have been obvious 
to a person in the art at the time the invention was made to modify the system disclosed in Bates 
et al. to have a displaying mechanism that is updated in real-time in order to ensure early 
detection of possible viral threats. This modification would have been obvious because a person 
having ordinary skill in the art, at the time the invention was made, would have been motivated 
to do so since Hill et al. suggest that displaying the possible threats in a manner that allows quick 
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interpretation of the situation is imperative in minimizing the impact that the virus may have on 
the hetwork as a whole in col. 7, Unes 3-17 and col. 9, lines 17-19. 
As per claims 2 and 13: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Hill et al. teach wherein the tracking user can configure the display modes to show 
the virus-tracking information in association with user-selected geographic maps of where the 
viruses are occurring (col. 3, lines 36-41). 
As per claims 3 and 14: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Hill et al. teach wherein display modes include a plurality of web pages with user 
selectable menus to configure the virus-tracking display on the pages (col. 9, lines 20-25)., 
As per claims 4 and 15: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Bates et al. teach a scan log contains no information relating to the direct 
identification of the client user (col. 12, lines 41-45). 
As per claims 5 and 16: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Hill et al. teach that the scan log includes the name of the virus, the frequency of its 
occurrence, and the geographic location of the infected computer (col. 8, lines 23-35). 
As per claims 6 and 17: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Bates et al. teach a servlet program on the virus-tracking server is used to receive 



Application/Control Number: 09/702,289 Page 6 

Art Unit: 2137 

the scan log information from the at least one anti-virus scanning server (coL 8, line 45 - col. 9, 
line 11). 

As per claims 7 and 18: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Bates et al. teach a polling program is used to regularly retrieve virus-tracking 
information from the database server and store it in a data object (col. 12, lines 37-58). 
As per claims 9 and 20: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Hill et al. teach a Java applet running on tracking user browser is used to display a 
real-time virus-tracing map (col. 6, lines 45-67). 
As per claims 1 1 and 22: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Bates et al. teach the system wherein the distributed computer network includes the 
Internet, wherein said scan log from each scarmed client computer is sent back over the Internet 
to be received by said virus tracking server (col. 8, line 45 - col. 9, line 1 1). Yet further. Hill et 
al. teach wherein said virus tracking display mode is accessible over the Internet by said tracking 
user (col. 8, lines 7-16). 
As per claims 23 and 25: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Hill et al. teach wherein said virus-tracking information identifies concentrations of 
a computer virus at said client end-user computer locations (col. 8, lines 23-35). 
As per claims 24 and 26: 
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Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Bates et al. teach wherein said scan log information is processed by aggregating 
said scan logs from each client end-user computer and then synthesizing said virus tracking 
information (col. 6, lines 6-20) 

III. Claims 8, 10, 19, and 21 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Bates et al., United States Patent No. 6,785,732 and Hill et al.. United States Patent No. 
6,088,804 as applied to claims 1, 7, 12, and 18 above, and further in view of Trcka et al., United 
States Patent No. 6,453,345 
As per claims 8 and 19: 

Bates et al. and Hill et al. substantially teach the system/method of claims 7 and 18. Not 
explicitly disclosed is a common gateway interface program used to retrieve the data object for 
display by the tracking user. Trcka et al. teach traffic capture components, which run 
continuously in the background, to passively generate a data stream that represents the traffic 
present on the network (col. 10, lines 60-66). It would have been obvious to a person having 
ordinary skill in the art at the time of the invention was made to modify Bates et al.'s 
collaborative server by reporting and logging information about viruses tracking for the client 
user in order that the client may utilize the information to deploy anti-virus programs. 
As per claims 1 0 and 21: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. Not 
explicitly disclosed is wherein the client user is also the tracking user. Trcka et al. teach from the 
screens, the user can specify such parameters as start time/date, end time/date, the types of events 
of interest. The user can specify search criteria and specific fields to be searched and can specify 
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an output type of the display screen, the printer, or the file (col. 20, lines 5-12). It would have 
been obvious to a person having ordinary skill in the art at the time of the invention was made to 
modify Bates et al.'s collaborative server by allowing the client user to also be the user, thus 
allowing individuals to set-up web sights and protect their computer from viruses by use of the 
allowed operations. 

^References Cited, Not Used 

The prior art, US Patent No. 6,721,721, made of record and not relied upon is considered 
pertinent to applicant's disclosure. US Patent No. 6,721,721 has been cited because it is relevant 
to the displaying/virus tracking portions of the claimed invention. 

Conclusion 

Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period' 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
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final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Nadia Khoshnoodi whose telephone number is (571) 272-3825. 
The examiner can normally be reached on M-F: 8:00-4:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300, 




Nadia Khoshnoodi 
Examiner 
Art Unit 2137 
9/1/2007 
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